<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,initial-scale=1"><title>eternal</title><meta name="author" content="eternal,1397239425@qq.com"><meta name="copyright" content="eternal"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta http-equiv="Cache-Control" content="no-transform"><meta http-equiv="Cache-Control" content="no-siteapp"><meta name="description" content="池鱼思故渊">
<meta property="og:type" content="website">
<meta property="og:title" content="eternal">
<meta property="og:url" content="http://example.com/index.html">
<meta property="og:site_name" content="eternal">
<meta property="og:description" content="池鱼思故渊">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="http://example.com/img/ccc.png">
<meta property="article:author" content="eternal">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="http://example.com/img/ccc.png"><link rel="shortcut icon" href="/img/ad.jpg"><link rel="canonical" href="http://example.com/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@latest/dist/jquery.fancybox.min.css"><script>var GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: undefined,
  translate: undefined,
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: false,
    post: false
  },
  runtime: '天',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  ClickShowText: {"text":"A,B,C,D,E,F,G","fontSize":"15px"},
  lightbox: 'fancybox',
  Snackbar: undefined,
  justifiedGallery: {
    js: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/js/jquery.justifiedGallery.min.js',
    css: 'https://cdn.jsdelivr.net/npm/justifiedGallery/dist/css/justifiedGallery.min.css'
  },
  isPhotoFigcaption: false,
  islazyload: false,
  isanchor: false
};

var saveToLocal = {
  set: function setWithExpiry(key, value, ttl) {
    const now = new Date()
    const expiryDay = ttl * 86400000
    const item = {
      value: value,
      expiry: now.getTime() + expiryDay,
    }
    localStorage.setItem(key, JSON.stringify(item))
  },

  get: function getWithExpiry(key) {
    const itemStr = localStorage.getItem(key)

    if (!itemStr) {
      return undefined
    }
    const item = JSON.parse(itemStr)
    const now = new Date()

    if (now.getTime() > item.expiry) {
      localStorage.removeItem(key)
      return undefined
    }
    return item.value
  }
}</script><script id="config_change">var GLOBAL_CONFIG_SITE = { 
  isPost: false,
  isHome: true,
  isHighlightShrink: false,
  isToc: false,
  postUpdate: '2021-01-27 13:10:18'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><link rel="stylesheet" href="APlayer.min.css"><div id="aplayer"></div><script src="https://cdn.jsdelivr.net/gh/radium-bit/res@master/live2d/autoload.js" async></script><script src="https://cdn.jsdelivr.net/npm/meting@2/dist/Meting.min.js" async></script><script>(function () {  window.activateDarkMode = function () {
    document.documentElement.setAttribute('data-theme', 'dark')
    if (document.querySelector('meta[name="theme-color"]') !== null) {
      document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
    }
  }
  window.activateLightMode = function () {
    document.documentElement.setAttribute('data-theme', 'light')
   if (document.querySelector('meta[name="theme-color"]') !== null) {
      document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
    }
  }
  const autoChangeMode = 'false'
  const t = saveToLocal.get('theme')
  if (autoChangeMode === '1') {
    const isDarkMode = window.matchMedia('(prefers-color-scheme: dark)').matches
    const isLightMode = window.matchMedia('(prefers-color-scheme: light)').matches
    const isNotSpecified = window.matchMedia('(prefers-color-scheme: no-preference)').matches
    const hasNoSupport = !isDarkMode && !isLightMode && !isNotSpecified
    if (t === undefined) {
      if (isLightMode) activateLightMode()
      else if (isDarkMode) activateDarkMode()
      else if (isNotSpecified || hasNoSupport) {
        const now = new Date()
        const hour = now.getHours()
        const isNight = hour <= 6 || hour >= 18
        isNight ? activateDarkMode() : activateLightMode()
      }
      window.matchMedia('(prefers-color-scheme: dark)').addListener(function (e) {
        if (saveToLocal.get('theme') === undefined) {
          e.matches ? activateDarkMode() : activateLightMode()
        }
      })
    } else if (t === 'light') activateLightMode()
    else activateDarkMode()
  } else if (autoChangeMode === '2') {
    const now = new Date()
    const hour = now.getHours()
    const isNight = hour <= 6 || hour >= 18
    if (t === undefined) isNight ? activateDarkMode() : activateLightMode()
    else if (t === 'light') activateLightMode()
    else activateDarkMode()
  } else {
    if (t === 'dark') activateDarkMode()
    else if (t === 'light') activateLightMode()
  }const asideStatus = saveToLocal.get('aside-status')
if (asideStatus !== undefined) {
   if (asideStatus === 'hide') {
     document.documentElement.classList.add('hide-aside')
   } else {
     document.documentElement.classList.remove('hide-aside')
   }
}})()</script><meta name="generator" content="Hexo 5.2.0"><link rel="alternate" href="/atom.xml" title="eternal" type="application/atom+xml">
</head><body><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="author-avatar"><img class="avatar-img" src="/img/ccc.png" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="site-data"><div class="data-item is-center"><div class="data-item-link"><a href="/archives/"><div class="headline">文章</div><div class="length-num">15</div></a></div></div><div class="data-item is-center"><div class="data-item-link"><a href="/tags/"><div class="headline">标签</div><div class="length-num">8</div></a></div></div><div class="data-item is-center"><div class="data-item-link"><a href="/categories/"><div class="headline">分类</div><div class="length-num">12</div></a></div></div></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div><div class="menus_item"><a class="site-page" href="javascript:void(0);"><i class="fa-fw fas fa-list"></i><span> 清单</span><i class="fas fa-chevron-down expand"></i></a><ul class="menus_item_child"><li><a class="site-page" href="/music/"><i class="fa-fw fas fa-music"></i><span> Music</span></a></li><li><a class="site-page" href="/photos/"><i class="fa-fw fa fa-camera-retro"></i><span> photos</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/shuoshuo/"><i class="fa-fw fa fa-star"></i><span> 说说</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> Link</span></a></div></div></div></div><div id="body-wrap"><header class="full_page" id="page-header" style="background-image: url(/img/14.jpg)"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">eternal</a></span><span id="menus"><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> 分类</span></a></div><div class="menus_item"><a class="site-page" href="javascript:void(0);"><i class="fa-fw fas fa-list"></i><span> 清单</span><i class="fas fa-chevron-down expand"></i></a><ul class="menus_item_child"><li><a class="site-page" href="/music/"><i class="fa-fw fas fa-music"></i><span> Music</span></a></li><li><a class="site-page" href="/photos/"><i class="fa-fw fa fa-camera-retro"></i><span> photos</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/shuoshuo/"><i class="fa-fw fa fa-star"></i><span> 说说</span></a></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> Link</span></a></div></div><span class="close" id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></span></span></nav><div id="site-info"><h1 id="site-title">eternal</h1><div id="site-subtitle"><span id="subtitle"></span></div><div id="site_social_icons"><a class="social-icon" href="https://github.com/mRdzut" target="_blank" title="Github"><i class="fab fa-github"></i></a><a class="social-icon" href="/img/qq.png" target="_blank" title="QQ"><i class="fab fa-qq"></i></a><a class="social-icon" href="/img/wechat.png" target="_blank" title="Wechat"><i class="fab fa-weixin"></i></a></div></div><div id="scroll-down"><i class="fas fa-angle-down scroll-down-effects"></i></div></header><main class="layout" id="content-inner"><div class="recent-posts" id="recent-posts"><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2021/01/24/%E5%A0%86%E5%A4%8D%E4%B9%A03-double%E2%80%94free/" title="堆复习3-double—free">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="堆复习3-double—free"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/01/24/%E5%A0%86%E5%A4%8D%E4%B9%A03-double%E2%80%94free/" title="堆复习3-double—free">堆复习3-double—free</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-01-24T09:48:32.000Z" title="发表于 2021-01-24 17:48:32">2021-01-24</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/%E5%A0%86/">堆</a></span></div><div class="content">ciscn_2019_en_31、首先利用puts函数只要输入长度为8就能泄露出一个基地址
2、申请两个chunk，chunk1内容为/bin/sh
3、对chunk0进行double free并对__free_hook劫持，改为system
4、释放chunk1
比较基础，只用到了double free和free_hook劫持
exp：#coding=utf-8from pwn import *from LibcSearcher import*context.log_level=&#x27;debug&#x27;pe=&#x27;./ciscn_2019_en_3&#x27;libc_23=&#x27;./libc-2.23.so&#x27;libc_27=&#x27;./libc-2.27.so&#x27;ip,port = &#x27;node3.buuoj.cn&#x27;,27452elf=ELF(pe)libc=ELF(libc_27)if args[&#x27;REMOTE&#x27;]:    p = remote(ip,port)else:    p = proces ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2021/01/23/%E5%A0%86%E5%A4%8D%E4%B9%A02-off-by-one%E5%8A%A0unlink/" title="堆复习2-off-by-one加unlink">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="堆复习2-off-by-one加unlink"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/01/23/%E5%A0%86%E5%A4%8D%E4%B9%A02-off-by-one%E5%8A%A0unlink/" title="堆复习2-off-by-one加unlink">堆复习2-off-by-one加unlink</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-01-23T14:16:39.000Z" title="发表于 2021-01-23 22:16:39">2021-01-23</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/%E5%A0%86/">堆</a></span></div><div class="content">利用思路axb_2019_heap主要还是要熟悉unlink的利用，在最后我放上了how2heap的unlink学习及程序调试流程

首先利用格式化字符串泄露 libc 和程序基址。
运用 unlink ，将 chunk 0 的地址覆写为 free_hook 的地址。
将system 地址写入 free_hook。
触发写入了 ‘/bin/sh’ 的块的删除，执行 system(‘/bin/sh’)。

exp：#coding=utf-8from pwn import *from LibcSearcher import*context.log_level=&#x27;debug&#x27;pe=&#x27;./axb_2019_heap&#x27;libc_23=&#x27;./libc-2.23.so&#x27;libc_27=&#x27;./libc-2.27.so&#x27;ip,port = &#x27;node3.buuoj.cn&#x27;,27128elf=ELF(pe)libc=ELF(libc_23)if args[&#x27;REMOTE&#x27;]:    p  ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2021/01/22/%E5%A0%86%E5%A4%8D%E4%B9%A0%E4%B9%8Boff-by-one%E5%92%8Cunlink/" title="堆复习之off_by_one和unlink">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="堆复习之off_by_one和unlink"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/01/22/%E5%A0%86%E5%A4%8D%E4%B9%A0%E4%B9%8Boff-by-one%E5%92%8Cunlink/" title="堆复习之off_by_one和unlink">堆复习之off_by_one和unlink</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-01-22T14:45:11.000Z" title="发表于 2021-01-22 22:45:11">2021-01-22</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/%E5%A0%86/">堆</a></span></div><div class="content">buuctf——bamboobox（unlink）利用思路
伪造一个空闲 chunk。
通过 unlink 把 chunk 移到存储 chunk 指针的内存处。
覆盖 chunk 0 指针为 atoi 的 got 表地址并泄露。
覆盖 atoi 的 got 表为 system 函数地址。
给出参数 ‘sh’，调用 atoi 函数拿 shell。

exp：#coding=utf-8from pwn import *from LibcSearcher import*context.log_level=&#x27;debug&#x27;if args[&#x27;REMOTE&#x27;]:    r = remote(&#x27;node3.buuoj.cn&#x27;,25306)    elf=ELF(&#x27;./bamboobox&#x27;)    libc=ELF(&#x27;/home/duxiansheng/pwn/libc/libc-2.23.so&#x27;)else:    r = process(&quot;./bamboobox&quot;)    elf=E ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2021/01/04/%E8%85%BE%E8%AE%AF%E4%BA%91%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%88%9D%E4%BD%93%E9%AA%8C/" title="腾讯云服务器初体验">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="腾讯云服务器初体验"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/01/04/%E8%85%BE%E8%AE%AF%E4%BA%91%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%88%9D%E4%BD%93%E9%AA%8C/" title="腾讯云服务器初体验">腾讯云服务器初体验</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-01-04T13:50:23.000Z" title="发表于 2021-01-04 21:50:23">2021-01-04</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/%E8%85%BE%E8%AE%AF%E4%BA%91/">腾讯云</a></span></div><div class="content">在好奇心的趋势下，我花了27个大洋在腾讯云上买了三个月的学生机打算探索一番。关键是这几个月一直在学习关于服务器的东西，想来也有一部分关系吧。
首先吐槽一下我自己，关于云服务器，真的是一点都不懂，问啥啥不知道，配置全靠度娘。
先说一下配置：
​                    1核的cpu
​                    2GB的内存
​                    1Mbps的带宽
​                    50GB的云盘
尝试之后我只能说，这种配置玩玩搭个网站就行了，别整花的，带不动。。。。。
下面来说一下我暂时知道的能干些啥：
第一：搭个博客（当然搭网站也可以，只要访问量不大，不怕被攻击，可以尝试。）
最简单的就是利用docker+wordpress+mysql搭建个人博客，方便快捷简单，教程可以参考我已经写过的文章“硬件实训2-2”
第二：搭建个人云盘
其实只要用量不大，搭建个云盘还是可以的，最起码上传速度和下载速度比某度快吧。
我是利用docker+NextCloud搭建的，方法简单网上全是教程，这里就不啰嗦了。
暂时我也就玩出着这两个 ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2021/01/03/%E5%88%9D%E6%8E%A2netty/" title="初探netty">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="初探netty"></a></div><div class="recent-post-info"><a class="article-title" href="/2021/01/03/%E5%88%9D%E6%8E%A2netty/" title="初探netty">初探netty</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2021-01-03T12:36:20.000Z" title="发表于 2021-01-03 20:36:20">2021-01-03</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/netty%E6%9C%8D%E5%8A%A1%E5%99%A8/">netty服务器</a></span></div><div class="content">关于nettynetty与我的境遇发生在给别人写课设之中！！！
听起来是不是很意外，那是一个夜黑风高的夜晚，外面下着大雨，皎洁的夜光照在我的脸上，此时一名joker正在看这篇博客……………(皮一下🤭)
netty官方源码（例子及用法说明一应俱全）：https://netty.io/wiki/index.html
netty在github的源码地址：https://github.com/netty/netty
netty是我第一次关于服务器方面的应用开发的学习，虽然学校并没又这一门课，但是感觉还是蛮重要的而且很有趣就试着自学一下。
netty是什么netty是一个异步的，事件驱动的网络编程框架。
netty是一个基于NIO（非阻塞IO）开发的网络通信框架。既然说到了NIO就提一下BIO（阻塞IO）。
NIO，同步非阻塞IO，阻塞业务处理但不阻塞数据接收，适用于高并发且处理简单的场景，比如聊天软件。
BIO，同步阻塞IO，阻塞整个步骤，如果连接少，他的延迟是最低的，因为一个线程只处理一个连接，适用于少连接且延迟低的场景，比如说数据库连接。
两种I/O模型的对比：
    
可以清楚的看到 ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2020/12/27/%E7%A1%AC%E4%BB%B6%E5%AE%9E%E8%AE%AD2-2/" title="硬件实训2-2">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="硬件实训2-2"></a></div><div class="recent-post-info"><a class="article-title" href="/2020/12/27/%E7%A1%AC%E4%BB%B6%E5%AE%9E%E8%AE%AD2-2/" title="硬件实训2-2">硬件实训2-2</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2020-12-27T03:04:49.000Z" title="发表于 2020-12-27 11:04:49">2020-12-27</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/docker%E3%80%81docker-compose%E3%80%81wordpress/">docker、docker-compose、wordpress</a></span></div><div class="content">任务：利用docker搭建一个本地的cms
目的：熟悉docker的使用，学习基于容器的应用部署
引题​    docker其实是一种虚拟化的技术，当前我们所了解的虚拟化可以分为主机虚拟化（熟知的vmware）和容器虚拟化（即docker），区别在于容器虚拟化的是操作系统而不是硬件，主机虚拟化是在物理机的基础上再搭建一个完整的主机系统。
​    用一句话来概括的话，主机级虚拟化就是通过各种各样的手段，把物理资源重新分配，然后抽象出一部分拿来做虚拟机的虚拟硬件，是对硬件的模拟；而容器虚拟化技术相当于把操作系统进行虚拟化，把物理的操作系统模拟为逻辑上的多个操作系统，不同的操作系统有自己的用户空间，实现了应用程序间的隔离。
两者的对比：
传统虚拟机技术是虚拟出一套硬件后，在其上运行一个完整操作系统，在该系统上再运行所需应用进程；而容器内的应用进程直接运行于宿主的内核，容器内没有自己的内核，而且也没有进行硬件虚拟。因此容器要比传统虚拟机更为轻便。


总结一下docker的优势：运行环境一致、更快的启动速度、隔离性、快速扩展、迁移方便、持续交付和部署、高内聚和低耦合。
docker基本概念I ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2020/12/27/%E7%A1%AC%E4%BB%B6%E5%AE%9E%E8%AE%AD2-1/" title="硬件实训2-1">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="硬件实训2-1"></a></div><div class="recent-post-info"><a class="article-title" href="/2020/12/27/%E7%A1%AC%E4%BB%B6%E5%AE%9E%E8%AE%AD2-1/" title="硬件实训2-1">硬件实训2-1</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2020-12-27T03:04:40.000Z" title="发表于 2020-12-27 11:04:40">2020-12-27</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/exsi/">exsi</a></span></div><div class="content">任务：VMware虚拟化ESXi的安装，并在ESXi中创建虚拟机。老师要求是要装Vcenter然后进行实验的，奈何本人笔记本太le se，内存实在太小装不了呀。呜呜呜。。。。
环境：VMware® Workstation 16 Pro、VMware ESXi 6.7、win10
正文：ESXI的搭建:
第一步自然是进官网下载ESXi的iso文件，没有iso可什么都做不了
下载完成开始安装：
vmware的使用的搭建肯定都会，就不演示了，下面来演示一下安装过程


continue继续

f11继续下一步安装


这是关于使用的ESXi空间，默认continue继续

默认美式键盘继续

设置密码，注意要包含字母、数字和符号

已经基本配置完成，f11开始下载

下载完成，重启

至此已经安装完成，我使用的是虚拟机的net模式，如果要使用桥接还需要进行配置：
f2进入设置


在这个页面你可你选择你的网络连接模式，重启网络，设置密码等


全部设置完成后就可以在浏览器界面管理你的服务器了：
（注意网址是你ESXi界面的DHCP地址）

在这里可以查看服务器的所有信息并管理设置服务器

创 ...</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2020/12/19/%E5%B0%8F%E8%AF%95%E7%89%9B%E5%88%80iot/" title="小试牛刀iot">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="小试牛刀iot"></a></div><div class="recent-post-info"><a class="article-title" href="/2020/12/19/%E5%B0%8F%E8%AF%95%E7%89%9B%E5%88%80iot/" title="小试牛刀iot">小试牛刀iot</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2020-12-19T08:34:47.000Z" title="发表于 2020-12-19 16:34:47">2020-12-19</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/%E5%9B%BA%E4%BB%B6/">固件</a></span></div><div class="content">查找方法过于漏洞记录的网站国内外有很多，我只介绍下面两个：
利用cve list查询已经发布的漏洞：https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=camera


利用exploit database查询，在我看来，exploit database的数据更将丰富清晰，但是漏洞库相比较少。https://www.exploit-db.com/exploits


工欲善其事必先利其器binwalk（解压固件包、查看固件信息） + ghidra（调试） 
下载地址：https://pan.baidu.com/s/1IY5YiIXuEmsCvglt0qgrzw 提取码: 78tu 
关于固件的下载和说明文档，我的建议是————百度下面我来介绍一个例子：D-Link DIR-645路由器漏洞描述：

固件下载地址：
链接: https://pan.baidu.com/s/1C1koxw1r6uOHzoNAo7PrmQ 提取码: mta9 
漏洞分析：__查询签名得到架构的信息__（一般是x86，x86_64，i386，amd64，mips，a ...</div></div></div><div class="recent-post-item"><div class="post_cover left_radius"><a href="/2020/12/14/%E7%A1%AC%E4%BB%B6%E5%AE%9E%E8%AE%AD%E4%B8%80/" title="硬件实训一">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="硬件实训一"></a></div><div class="recent-post-info"><a class="article-title" href="/2020/12/14/%E7%A1%AC%E4%BB%B6%E5%AE%9E%E8%AE%AD%E4%B8%80/" title="硬件实训一">硬件实训一</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2020-12-14T05:33:53.000Z" title="发表于 2020-12-14 13:33:53">2020-12-14</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/%E5%AE%9E%E8%AE%AD/">实训</a></span></div><div class="content">台式计算机的硬件选购任务：5000块以下配置一台学习人工智能的计算机
第一节实训课我直接“啊这”好吧，让一个选择恐惧症去京东shopping简直就是折磨，关键还一口气shopping了一个上午。
下面是我选的配置（5000以下配置人工智能的计算机，简直了好吧！）
intel:

AMD:

</div></div></div><div class="recent-post-item"><div class="post_cover right_radius"><a href="/2020/12/02/ZJCTF-2019-EasyHeap/" title="ZJCTF_2019_EasyHeap">     <img class="post_bg" src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="ZJCTF_2019_EasyHeap"></a></div><div class="recent-post-info"><a class="article-title" href="/2020/12/02/ZJCTF-2019-EasyHeap/" title="ZJCTF_2019_EasyHeap">ZJCTF_2019_EasyHeap</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">发表于</span><time datetime="2020-12-02T13:41:42.000Z" title="发表于 2020-12-02 21:41:42">2020-12-02</time></span><span class="article-meta"><span class="article-meta__separator">|</span><i class="fas fa-inbox article-meta__icon"></i><a class="article-meta__categories" href="/categories/heap/">heap</a></span></div><div class="content">
有system函数，那么就很好了，不用泄露libc了，直接跳转拿到flag？不可能的，这是个坑，里面什么都没有。

edit函数可以竟然可以重新编辑堆块的大小，堆溢出！！！

delete函数没什么用，free后置零，不存在uaf。
思路：
1、申请三个堆块，将/bin/sh写入chunk1。
2、利用house of spirit伪造堆块（伪造 chunk 至 heaparray 附近，这样操作在 malloc fastbin 时需要绕过大小判断，我们可以巧妙地利用地址开头 7f 来伪造大小为 0x70 的 fastbin ）
3、利用伪造的堆块将chunk0的地址覆盖为free_got地址
4、将free_got地址改写为system的地址
5、此时free chunk1就能拿到shell。
exp:
#coding=utf-8from pwn import *from LibcSearcher import*context.log_level=&#x27;debug&#x27;if args[&#x27;REMOTE&#x27;]:    p = remote(&#x27;no ...</div></div></div><nav id="pagination"><div class="pagination"><span class="page-number current">1</span><a class="page-number" href="/page/2/">2</a><a class="extend next" rel="next" href="/page/2/"><i class="fas fa-chevron-right fa-fw"></i></a></div></nav></div><div class="aside_content" id="aside_content"><div class="card-widget card-info"><div class="card-content"><div class="card-info-avatar is-center"><img class="avatar-img" src="/img/ccc.png" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/><div class="author-info__name">eternal</div><div class="author-info__description">池鱼思故渊</div></div><div class="card-info-data"><div class="card-info-data-item is-center"><a href="/archives/"><div class="headline">文章</div><div class="length-num">15</div></a></div><div class="card-info-data-item is-center"><a href="/tags/"><div class="headline">标签</div><div class="length-num">8</div></a></div><div class="card-info-data-item is-center"><a href="/categories/"><div class="headline">分类</div><div class="length-num">12</div></a></div></div><a class="button--animated" id="card-info-btn" target="_blank" rel="noopener" href="https://github.com/mRdzut"><i class="fab fa-github"></i><span>mRdzut</span></a><div class="card-info-social-icons is-center"><a class="social-icon" href="https://github.com/mRdzut" target="_blank" title="Github"><i class="fab fa-github"></i></a><a class="social-icon" href="/img/qq.png" target="_blank" title="QQ"><i class="fab fa-qq"></i></a><a class="social-icon" href="/img/wechat.png" target="_blank" title="Wechat"><i class="fab fa-weixin"></i></a></div></div></div><div class="card-widget card-announcement"><div class="card-content"><div class="item-headline"><i class="fas fa-bullhorn card-announcement-animation"></i><span>公告</span></div><div class="announcement_content">欢迎！</div></div></div><div class="sticky_layout"><div class="card-widget card-recent-post"><div class="card-content"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item"><a class="thumbnail" href="/2021/01/24/%E5%A0%86%E5%A4%8D%E4%B9%A03-double%E2%80%94free/" title="堆复习3-double—free"><img src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="堆复习3-double—free"/></a><div class="content"><a class="title" href="/2021/01/24/%E5%A0%86%E5%A4%8D%E4%B9%A03-double%E2%80%94free/" title="堆复习3-double—free">堆复习3-double—free</a><time datetime="2021-01-24T09:48:32.000Z" title="发表于 2021-01-24 17:48:32">2021-01-24</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2021/01/23/%E5%A0%86%E5%A4%8D%E4%B9%A02-off-by-one%E5%8A%A0unlink/" title="堆复习2-off-by-one加unlink"><img src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="堆复习2-off-by-one加unlink"/></a><div class="content"><a class="title" href="/2021/01/23/%E5%A0%86%E5%A4%8D%E4%B9%A02-off-by-one%E5%8A%A0unlink/" title="堆复习2-off-by-one加unlink">堆复习2-off-by-one加unlink</a><time datetime="2021-01-23T14:16:39.000Z" title="发表于 2021-01-23 22:16:39">2021-01-23</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2021/01/22/%E5%A0%86%E5%A4%8D%E4%B9%A0%E4%B9%8Boff-by-one%E5%92%8Cunlink/" title="堆复习之off_by_one和unlink"><img src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="堆复习之off_by_one和unlink"/></a><div class="content"><a class="title" href="/2021/01/22/%E5%A0%86%E5%A4%8D%E4%B9%A0%E4%B9%8Boff-by-one%E5%92%8Cunlink/" title="堆复习之off_by_one和unlink">堆复习之off_by_one和unlink</a><time datetime="2021-01-22T14:45:11.000Z" title="发表于 2021-01-22 22:45:11">2021-01-22</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2021/01/04/%E8%85%BE%E8%AE%AF%E4%BA%91%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%88%9D%E4%BD%93%E9%AA%8C/" title="腾讯云服务器初体验"><img src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="腾讯云服务器初体验"/></a><div class="content"><a class="title" href="/2021/01/04/%E8%85%BE%E8%AE%AF%E4%BA%91%E6%9C%8D%E5%8A%A1%E5%99%A8%E5%88%9D%E4%BD%93%E9%AA%8C/" title="腾讯云服务器初体验">腾讯云服务器初体验</a><time datetime="2021-01-04T13:50:23.000Z" title="发表于 2021-01-04 21:50:23">2021-01-04</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/2021/01/03/%E5%88%9D%E6%8E%A2netty/" title="初探netty"><img src="https://i.loli.net/2020/05/01/gkihqEjXxJ5UZ1C.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="初探netty"/></a><div class="content"><a class="title" href="/2021/01/03/%E5%88%9D%E6%8E%A2netty/" title="初探netty">初探netty</a><time datetime="2021-01-03T12:36:20.000Z" title="发表于 2021-01-03 20:36:20">2021-01-03</time></div></div></div></div></div><div class="card-widget card-categories"><div class="card-content"><div class="item-headline"><i class="fas fa-folder-open"></i><span>分类</span></div><ul class="card-category-list" id="aside-cat-list">
            <li class="card-category-list-item "><a class="card-category-list-link" href="/categories/Dmctf2020/"><span class="card-category-list-name">Dmctf2020</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/GeekPwn/"><span class="card-category-list-name">GeekPwn</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/do-global-dtors-aux/"><span class="card-category-list-name">__do_global_dtors_aux</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/docker%E3%80%81docker-compose%E3%80%81wordpress/"><span class="card-category-list-name">docker、docker-compose、wordpress</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/exsi/"><span class="card-category-list-name">exsi</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/heap/"><span class="card-category-list-name">heap</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/netty%E6%9C%8D%E5%8A%A1%E5%99%A8/"><span class="card-category-list-name">netty服务器</span><span class="card-category-list-count">1</span></a></li><li class="card-category-list-item "><a class="card-category-list-link" href="/categories/%E5%9B%BA%E4%BB%B6/"><span class="card-category-list-name">固件</span><span class="card-category-list-count">1</span></a></li>
            <li class="card-category-list-item more is-center"><a class="card-category-list-link-more" href="/categories/">
                <span>查看更多</span><i class="fas fa-angle-right"></i></a></li>
            </ul></div></div><div class="card-widget card-tags"><div class="card-content"><div class="item-headline"><i class="fas fa-tags"></i><span>标签</span></div><div class="card-tag-cloud"><a href="/tags/buuctf/" style="font-size: 1.1em; color: #999">buuctf</a> <a href="/tags/ctf/" style="font-size: 1.5em; color: #99a9bf">ctf</a> <a href="/tags/iot/" style="font-size: 1.1em; color: #999">iot</a> <a href="/tags/netty/" style="font-size: 1.1em; color: #999">netty</a> <a href="/tags/pwn/" style="font-size: 1.3em; color: #99a1ac">pwn</a> <a href="/tags/%E5%AE%9E%E8%AE%AD/" style="font-size: 1.1em; color: #999">实训</a> <a href="/tags/%E6%9C%8D%E5%8A%A1%E5%99%A8/" style="font-size: 1.1em; color: #999">服务器</a> <a href="/tags/%E7%A1%AC%E4%BB%B6%E5%AE%9E%E8%AE%AD/" style="font-size: 1.3em; color: #99a1ac">硬件实训</a></div></div></div><div class="card-widget card-archives"><div class="card-content"><div class="item-headline"><i class="fas fa-archive"></i><span>归档</span></div><ul class="card-archive-list"><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2021/01/"><span class="card-archive-list-date">一月 2021</span><span class="card-archive-list-count">5</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2020/12/"><span class="card-archive-list-date">十二月 2020</span><span class="card-archive-list-count">6</span></a></li><li class="card-archive-list-item"><a class="card-archive-list-link" href="/archives/2020/11/"><span class="card-archive-list-date">十一月 2020</span><span class="card-archive-list-count">4</span></a></li></ul></div></div><div class="card-widget card-webinfo"><div class="card-content"><div class="item-headline"><i class="fas fa-chart-line"></i><span>网站资讯</span></div><div class="webinfo"><div class="webinfo-item"><div class="item-name">文章数目 :</div><div class="item-count">15</div></div><div class="webinfo-item"><div class="item-name">已运行时间 :</div><div class="item-count" id="runtimeshow" data-publishDate="2020-12-03T16:00:00.000Z"></div></div><div class="webinfo-item"><div class="item-name">本站访客数 :</div><div class="item-count" id="busuanzi_value_site_uv"></div></div><div class="webinfo-item"><div class="item-name">本站总访问量 :</div><div class="item-count" id="busuanzi_value_site_pv"></div></div><div class="webinfo-item"><div class="item-name">最后更新时间 :</div><div class="item-count" id="last-push-date" data-lastPushDate="2021-01-27T05:10:18.046Z"></div></div></div></div></div></div></div></main><footer id="footer" style="background-image: url(/img/14.jpg)"><div id="footer-wrap"><div class="copyright">&copy;2020 - 2021 By eternal</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog"></i></button><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div><script src="https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js"></script><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/fancybox@latest/dist/jquery.fancybox.min.js"></script><div class="js-pjax"><script>function subtitleType () {
  if (true) { 
    var typed = new Typed("#subtitle", {
      strings: "所有的收获，一定要全力以赴，奋不顾身...".split(","),
      startDelay: 300,
      typeSpeed: 150,
      loop: true,
      backSpeed: 50
    })
  } else {
    document.getElementById("subtitle").innerHTML = '所'
  }
}

if (true) {
  if (typeof Typed === 'function') subtitleType()
  else $.getScript('https://cdn.jsdelivr.net/npm/typed.js/lib/typed.min.js', subtitleType)
} else {
  subtitleType()
}</script><script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div><script defer="defer" id="fluttering_ribbon" mobile="true" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/canvas-fluttering-ribbon.min.js"></script><script id="canvas_nest" defer="defer" color="0,0,255" opacity="0.7" zIndex="-1" count="99" mobile="false" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/canvas-nest.min.js"></script><script id="click-show-text" src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1/dist/click-show-text.min.js" async="async" mobile="false"></script></div><script src="/live2d_models/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2d_models/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"model":{"scale":1,"hHeadPos":0.5,"vHeadPos":0.618,"jsonPath":"/live2d_models/assets/assets/haru01.model.json"},"display":{"superSample":2,"width":150,"height":300,"position":"left","hOffset":0,"vOffset":-20},"mobile":{"show":true,"scale":0.5},"react":{"opacityDefault":0.7,"opacityOnHover":0.8},"log":false});</script></body></html>